file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

456KB
MD5

a8145015691ccb73460a69fa0a8b0304
SHA1

d1f61cd7ccf682868720dacfc91f50ce4e70412b
SHA256

eff416f17b83327e6911308b2b9678f52fb4b4d20b99a96f43c2478e5dcc10f2
SHA512

246c43e235fa7c5b4ec9575dd68448db19b28532f5bb51b3baa9b3637a990f25c3677b54fc40d47bd0ced5e97fb10dbe0a04e0df5516f9ca24a5bf47fb2a78f1
SSDEEP

6144:I1/tBaOZZfURQrLmwCn/2L04fiOFnZitWpqdc6WwjLC6a2HEZ+rG7tUW:mtbRURQ+wC+9KtWpqSNg+6RrqtUW

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0a:58:ea:a5:74:cb:df:66:c3:ae:42:b9:23:14:4c:13
Certificate

Issuer

CN=installrox inc\ ,C=CN

Not Before

01-12-2023 16:19

Not After

01-12-2024 16:19

Subject

CN=installrox inc\ ,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:43:aa:58:eb:09:c6:87:20:87:3b:a8:ae:4d:7b:47:20:64:95:47:62:de:ea:0c:31:cf:df:34:f9:32:9b:1d
Signer

Actual PE Digest

9f:43:aa:58:eb:09:c6:87:20:87:3b:a8:ae:4d:7b:47:20:64:95:47:62:de:ea:0c:31:cf:df:34:f9:32:9b:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0a:58:ea:a5:74:cb:df:66:c3:ae:42:b9:23:14:4c:13Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

9f:43:aa:58:eb:09:c6:87:20:87:3b:a8:ae:4d:7b:47:20:64:95:47:62:de:ea:0c:31:cf:df:34:f9:32:9b:1dSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 448KB - Virtual size: 448KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

0a:58:ea:a5:74:cb:df:66:c3:ae:42:b9:23:14:4c:13
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

9f:43:aa:58:eb:09:c6:87:20:87:3b:a8:ae:4d:7b:47:20:64:95:47:62:de:ea:0c:31:cf:df:34:f9:32:9b:1d
Signer

.text
Size: 448KB - Virtual size: 448KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B